1d46ce8f6bc4d59ffa5b63b6f01bb88e386bb38559602e6249ecf4340a3dbcd5

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Claude Setup.exe
Size 6.7MB
Sample260730-vyfgestard
SHA256 1d46ce8f6bc4d59ffa5b63b6f01bb88e386bb38559602e6249ecf4340a3dbcd5
MD5 d89bad0b9a60e6fbaaf56c118e0183a8
SHA1 a039012eebb6420b7dd3cdb7b749416d77792676
SHA512 4ba104978e7058e373a127e789dfdab24334eb2461dee492566f4c7f94dddeb0ace59afb783b89b015a648a5d552cab8874e204d81cdcf783d1eb7972bbe1d80
SSDEEP 49152:0FATMATweCaOM1liQ9cz5iqCoFeUwXohxpI4Xp8tiaZch/75vh6YnpjCMvBY7wKS:0FrZlxFlca7p7ainO+OE9
TLSH
T1BC665A43ECA555E9C0AEE23485729253BA717C485F3123D76BA0F7382F76BC06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\ = "URL:claude"	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\shell	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{E9EFEDD5-6F90-4910-8378-D502A8233158}	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\URL Protocol	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\shell\open\command	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\shell\open	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3320	reg.exe
2472	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3280	Claude Setup.exe
3280	Claude Setup.exe
3852	cowork-svc.exe
3852	cowork-svc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe
Token: SeShutdownPrivilege	2100	Claude.exe
Token: SeCreatePagefilePrivilege	2100	Claude.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2100	Claude.exe
2100	Claude.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2100	Claude.exe
2100	Claude.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4524	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 3280	704	Claude Setup.exe	89
PID 3280 wrote to memory of 2576	3280	Claude Setup.exe	94
PID 2100 wrote to memory of 4708	2100	Claude.exe	99
PID 2100 wrote to memory of 4400	2100	Claude.exe	100
PID 2100 wrote to memory of 612	2100	Claude.exe	101
PID 2100 wrote to memory of 2124	2100	Claude.exe	102
PID 2100 wrote to memory of 2356	2100	Claude.exe	103
PID 2100 wrote to memory of 2472	2100	Claude.exe	104
PID 2100 wrote to memory of 3320	2100	Claude.exe	105
PID 2100 wrote to memory of 1264	2100	Claude.exe	108
PID 2100 wrote to memory of 9100	2100	Claude.exe	109
PID 2100 wrote to memory of 9092	2100	Claude.exe	110

C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:704
- C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe" --elevated --msix-path "C:\Users\Admin\AppData\Local\Temp\Claude-2018801920.msix" --log-path "C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log" --all-users
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\explorer.exe
    explorer.exe shell:AppsFolder\Claude_pzs8sxrjxfjjc!Claude
    3⤵
    PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:5464

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4524

C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
"C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3852

C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe
"C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=1.24012.9 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.0 --initial-client-data=0x4c4,0x4c8,0x4cc,0x4c0,0x4d0,0x7ff76fcbd188,0x7ff76fcbd198,0x7ff76fcbd1a8
  2⤵
  PID:4708
- C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,14633125729264544334,7039556477987865018,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16519388701621491338,887555614088548148,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1952,i,14633125729264544334,7039556477987865018,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16519388701621491338,887555614088548148,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2024 /prefetch:11
  2⤵
  PID:612
- C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1785431683558923 --launch-time-ticks=648962769 --field-trial-handle=1952,i,14633125729264544334,7039556477987865018,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16519388701621491338,887555614088548148,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2936 --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1785431683558923 --launch-time-ticks=648978677 --field-trial-handle=1952,i,14633125729264544334,7039556477987865018,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16519388701621491338,887555614088548148,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3044 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.24012.9\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:2356
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:2472
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:3320
- C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1785431683558923 --launch-time-ticks=649897915 --field-trial-handle=1952,i,14633125729264544334,7039556477987865018,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16519388701621491338,887555614088548148,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4204 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.24012.9\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1952,i,14633125729264544334,7039556477987865018,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16519388701621491338,887555614088548148,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4700 /prefetch:14
  2⤵
  - Modifies registry class
  PID:9100
- C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.9.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1952,i,14633125729264544334,7039556477987865018,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16519388701621491338,887555614088548148,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4680 /prefetch:12
  2⤵
  PID:9092

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F8
1⤵
PID:9212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data_2

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

cf9d1291-bc1e-42df-8216-7ad7edc6173d.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\cf9d1291-bc1e-42df-8216-7ad7edc6173d.tmp
Size 48B
SHA256 b7797912e617e8b14f570d77a0336f8f6c7f19475428fd8961ae9b98f60b4f8d
MD5 8f27ddad2ddff343a76c9badee79ad66
SHA1 bc398bddcddd12bfa9c5bd6d91d53691d518513c
SHA512 9652a2957ddd6b00f71ca270e9e787b585dc5a2df3b6e813c6e557eaba0bdd7135abeb4132a56e21c59020f6aa73435c82701ff5bf3708112b8fb95eaec3fbcd
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4592df65c1ea08187b8696d661fecb6bbf5213b7c3aea71a3eaba1196183c701
MD5 781d842778d05ef7db7905e81da5a716
SHA1 89687d3181b8bad53bf4068e7f8788bfcc333e4f
SHA512 3129c819315f533af4872f1772ad293cce0622d18339c73ca1fbf2e03e87fe932ef1e7e4224dd3c5e922ea39fbb49b004e747f2482b743860df628b0af53680d
TLSH
T1073193DC9D8A2151DF41457CB5E64CD97AFD380C6C0F5FE1A59A9A3F90743A43023BA0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent State
Size 1KB
SHA256 031e7a2429979caf193bde2e06cc54da804f9acce2d2e9ab6f78635e211759c4
MD5 00ccc2aaf3da72d88b75be8a9f3ffa22
SHA1 4b1e040c01d926bc30496870f102b6064cadfe7f
SHA512 99a01df8a4ff2b91e842a0c8ef94c874d43b5b1e313d25e7f94277a4f7f40c428e5bce70d909008618484e55275f00b478d418dc2a89a5bb0dae5ce9b6b82ba8
TLSH
T1AE31CE86C3ED027DC6A227F56F217963C1AE1A5C93587C03C8D9EFCE67E14315A1164D
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Preferences
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

27d6d251-c6a5-4a0f-b400-80bc13e7cf16.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\27d6d251-c6a5-4a0f-b400-80bc13e7cf16.tmp
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

75c84528-0d80-4928-ad53-a715403fe980.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\75c84528-0d80-4928-ad53-a715403fe980.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Preferences
Size 132B
SHA256 82f783481f1faf00c8da1dfa83b22a97375d249bc3252eeea5398d1d7c2c5873
MD5 96e0f133ef2f6fb231343abfea27545f
SHA1 9e8846c2acbffcc989da7903f4e01f0fcc29a197
SHA512 5d104080662f3bb1391fbab8b69def85810c01a0253d1dbfba5c05d03ed18250201b96d1d45107961aa7e645faf836609d0e149a21872b50d02b7838ae5bd827
TLSH
T1E0C02B0190021135093FCC5340065C4E48E107544B0B48A185D431104D5A61D058304F
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 42B
SHA256 98b805bc0153d150b2f1658f8a7fd7119a2a7556d2a7fdd1226bc505e86c7247
MD5 2275e228b9a00100ecb0a475e6851fcb
SHA1 7863bd59ed561697fb071317fbfae1d70f65ec40
SHA512 3e1724f47b7677b4cd73400620d2e278bc515a759c0d9d5b832c4885194e5ed6de92c6dc6cbcc72d24dabcf55f3a7b1e11ac9b8c1da5c799ec561c62d2325dc6
MD5 SHA1 SHA512

Submit Download

config.json.tmp-54323354273d29f3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-54323354273d29f3
Size 77B
SHA256 b1dd005b59de8727904ca2b2c9f8671778a09f3ebeb74826be1f1eb1a52802eb
MD5 72b6ed6806760a27958b3779bd47b029
SHA1 0971eb0d50c5960af7bd739c86a19b24081442c7
SHA512 2266a0f91bf0b958477982f1f153cfbc3cdc22ae12c31abdc3f20315815573204f97bdaeb4660ec9f231728948bfeb54532cd62eac7d782398adb594aaed7d15
TLSH
T173A0228CF0200002CE0F03BC8C8C80EB82AF2BCCA20B00000828C32CCA80BEC3C0E380
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-54323358850289e0

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-54323358850289e0
Size 62B
SHA256 572a6d29203dbf7b8b954039d0c4d20a6b80dfd77500bd51265bf5505134ff69
MD5 ad8081ff1b4ac8c9e5fb586a0051ece7
SHA1 02046b03f449dab0185eaccc1ff0aa9a14493d82
SHA512 8d3fb2d63db024820c70568d3467966a7c0e1d6407d55775c0c95cb3c8c4a1fe3e2559f5f38c96f2851ab75d235e3b62e9dbd808a6e28ab174fb7f704cf2fd3c
TLSH
T1B2A00228C0215113E41482AC080410CA85EB16AC6A0B1D068A95B249C546BFC1D4E755
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-543233603729d4cd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-543233603729d4cd
Size 70B
SHA256 06c1e66e31b0a79f3f6a807c8b3963ee23c071c44f97392232fe773d8ada2c56
MD5 dbc18570c7104da2d2e3d1cc4d4b6cbd
SHA1 6153bfc517623b236ffedf7a719c93db157ed015
SHA512 17f70fc2d42d2df779d12c6ebe0f9f90e3bd4d26ffa2a4e60c4ac21e9dd6cad6203242f0226278ba9bba9e7e180cc300509d27e5d4001d7cab9f8b3519218859
TLSH
T1B1A02238C0200003E800823C000C00CE80BF3B2C8802000F8CA8820CC200FF83E38F20
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-543233617629167e

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-543233617629167e
Size 75B
SHA256 0404a38803177b650d1157e7eb110e2dbcb95bb77ba0a963859b240ec0c8005c
MD5 de6875a7021adb5262a30f40ef3bdd07
SHA1 aaf7c91af350f35ed699a69e21ec03abb2278505
SHA512 580b7cf84cd8f79d7858216c074c09e21f3f7a48960ad38559eebfc2809ae991c49ab3e00adb48c400878e645816dd6f19fbda27f7031ed27734d74b3cd2d52e
TLSH
T171A0222AC0200232E0300BAC0F08328B8CAB020C008A0C00CF0AEB8CE0003FE0C0ABE0
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.9gqg47wri5h6ouiy0kunueji.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.9gqg47wri5h6ouiy0kunueji.tmp
Size 10KB
SHA256 720462cb481ea3b67db2f32eac604e06a5e5e2111a58bac6b528c53b28b9f66d
MD5 fbd2414770115e65e198d3cabd83a7eb
SHA1 b73346bd881e13ec7d01ebcfc9d0c95a15d8803f
SHA512 90706a465bc4e60d3e2c94794064060944c33e9b0ba0487bb49792b1bedb24e32fd30f3f321201cdb74680a6aeebda0f4712a3d5d46644da1ec6f338ad0309e8
SSDEEP 192:9ZNyEIYiYF80dmL4pUQaULc8pq8RuX5hz28uNNTPKTD98pMLJ:9ZNyEIYi2mL4/y8RKE7gwMLJ
TLSH
T11D225BA389906C05ED27AD10B4D4A53BEEB1B28A6DD0D2C27159C162CB843873FDD2FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.l4qk2789waeg5uvuliy_qt1fh.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.l4qk2789waeg5uvuliy_qt1fh.tmp
Size 1007KB
SHA256 b7c43931758fd5cc6bfd6c6aee67943bca60183c460bdf4e4fad8497f945fdb8
MD5 315e512dbcb067e4e0ea6b0c0dd56945
SHA1 29184ea59a952a91f2eeb7193831db3b829029c6
SHA512 f868d4dcceccfc4c54f8f569e467bf3bdee8ae8a8f9c18fad42b1d6fe2335a6cca4a3c6771c7272d9ec367278336154883a404f93a7dca25fffb433e2881d6fd
SSDEEP 12288:2yFkAQVl47FfCmUNGeIgZKQdv3r16iMUP7ipHe71mT+9RGb:9unEfCmUNGeIg393h/MUP7we7D/W
TLSH
T10025B5E1512DBE36816D0AAD8F24F5042C35883653376E0E9C6EA2B31CBF9725F674E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.mkmcisob6avc2uaynsxmw7obb.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.mkmcisob6avc2uaynsxmw7obb.tmp
Size 7KB
SHA256 e7d0e1dbea3f8c705dd28157abbc31d47e1f90be685bfbc1fa508940fbc019bc
MD5 ab61dcc40a47026832059652bdd43104
SHA1 3b221225e909d2dba29fe5d0b2115674fd12725e
SHA512 9294279fc85188f3952dc1493423e9dafa689c06c594bb21ce6761324382eae5a26bc52e0e205d5258ba1cb95a7312342a8a1f71e279a028b1369f70c4ce5173
SSDEEP 192:rJG1F4Ra8brotDtq6LYYcwmbTYp+bkk6W+Gkk63:rJG1F4Ra8brotDtTLY/wJ+bkk6W+Gkku
TLSH
T13BF1024BD4AD18504672E1AAAF13D686EB2C099758DE00C0BCDD56432FB265F033BB9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClaudeSetup.log

Path C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log
Size 3KB
SHA256 81271ff9230e499207e7ed6b67021ab22162a2b2c487f445e20886da610c8990
MD5 50081a556fc8be0ecc785c14a09e67ce
SHA1 dacfab9c4354ae52ba7cec7c32c3d3ac324f5bb2
SHA512 7697b540884084432c50200c75907897c6c5949e09cbe5033e88f37bed41c45667720074649e29a686a752154dcc9f2be82b78da516e62bf4c6ccfe59549a904
TLSH
T1AE71BAE6DAA7E2FB0F784805E5F6428763BB7409B6CD81D07600D07C54D3EA9ABC16C6
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1264-171-0x000001BEA2B10000-0x000001BEA2B11000-memory.dmp

Download

memory/1264-1714-0x000001BEA2AE0000-0x000001BEA2B0A000-memory.dmp

Download

memory/2124-1713-0x0000022C0B730000-0x0000022C0B75A000-memory.dmp

Download

memory/2124-133-0x0000022C0B760000-0x0000022C0B761000-memory.dmp

Download

memory/2356-267-0x000001FFCEFD0000-0x000001FFCEFFA000-memory.dmp

Download

memory/2356-130-0x00007FFAA63F0000-0x00007FFAA63F1000-memory.dmp

Download

memory/2356-131-0x000001FFD0000000-0x000001FFD0001000-memory.dmp

Download